safe-shell-execution-claude-code

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This is a defensive shell-safety checklist with no executable payload, but users should understand that it permits some destructive commands after confirmation rather than blocking them outright.

Install this only if you want an agent-wide shell safety checklist that may be consulted for many command-related tasks. Review the policy around destructive commands: it asks for confirmation for operations such as force pushes, hard resets, and recursive deletion instead of categorically refusing all of them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Git Operations

text

git reset --hard              → "May discard all uncommitted changes"
git push --force / -f         → "May overwrite remote history"
git clean -f (without -n flag) → "May permanently delete untracked files"
git checkout -- .             → "May discard all workspace changes"

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 89% confidence

Finding

The YARA match is triggered by a cluster of highly destructive commands that the skill contemplates allowing after warning and confirmation. While the intent is defensive, the policy is still risky because it operationalizes destructive autonomous actions instead of prohibiting the most dangerous ones outright.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

, can execute arbitrary code

• zf_rm / zf_mv / zf_ln / zf_chmod / zf_chown / zf_mkdir / zf_rmdir — Built-in file operations, can bypass binary whitelists

---

Layer 2: Destructive Operation Warnings (Confirm Before Execution)

These operations are legitimate but irreversible. Display specific warnings and require user confirmation before execution.

Git Operations

text

git reset --hard              → "May discard all uncommitted changes"
git push --force / -f         → "May overwrite remote history"
git clean -f (without -n flag) → "May permanently delete untracked files"
git checkout -- .             → "May discard all workspace changes"
git restore .                 → "May discard all workspace changes"
git stash drop / clear        → "May permanently delete stashed content"
git branch -D                 → "May force-delete a branch"
git commit --amend            → "May rewrite the last commit"
git commit/push --no-verify   → "May skip se

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

text

git reset --hard              → "May discard all uncommitted changes"
git push --force / -f         → "May overwrite remote history"
git clean -f (without -n flag) → "May permanently delete untracked files"
git checkout -- .             → "May discard all workspace changes"
git restore .                 → "May discard all workspace changes"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

git stash drop / clear → "May permanently delete stashed content" git branch -D → "May force-delete a branch" git commit --amend → "May rewrite the last commit" git commit/push --no-verify → "May skip security hooks"

text

### File System

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The general policy line classifying recursive force-delete patterns as 'confirm before execution' is too permissive for a safety skill. In agent-driven execution, destructive filesystem commands need stronger default-deny behavior because confirmation mechanisms are often vulnerable to social engineering or prompt-level confusion.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

File System

text

rm -rf / rm -fr / rm -r -f / rm -f -r  → "May recursively force-delete files"

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The general policy line classifying recursive force-delete patterns as 'confirm before execution' is too permissive for a safety skill. In agent-driven execution, destructive filesystem commands need stronger default-deny behavior because confirmation mechanisms are often vulnerable to social engineering or prompt-level confusion.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

File System

text

rm -rf / rm -fr / rm -r -f / rm -f -r  → "May recursively force-delete files"

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The general policy line classifying recursive force-delete patterns as 'confirm before execution' is too permissive for a safety skill. In agent-driven execution, destructive filesystem commands need stronger default-deny behavior because confirmation mechanisms are often vulnerable to social engineering or prompt-level confusion.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

File System

text

rm -rf / rm -fr / rm -r -f / rm -f -r  → "May recursively force-delete files"

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The general policy line classifying recursive force-delete patterns as 'confirm before execution' is too permissive for a safety skill. In agent-driven execution, destructive filesystem commands need stronger default-deny behavior because confirmation mechanisms are often vulnerable to social engineering or prompt-level confusion.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

File System

text

rm -rf / rm -fr / rm -r -f / rm -f -r  → "May recursively force-delete files"

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The general policy line classifying recursive force-delete patterns as 'confirm before execution' is too permissive for a safety skill. In agent-driven execution, destructive filesystem commands need stronger default-deny behavior because confirmation mechanisms are often vulnerable to social engineering or prompt-level confusion.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

File System

text

rm -rf / rm -fr / rm -r -f / rm -f -r  → "May recursively force-delete files"

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

.gitconfig  .gitmodules

# Package manager credentials
.npmrc  .pypirc  ~/.pip/pip.conf

# Credentials and keys
~/.ssh/           ~/.aws/

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

known_hosts

System files

/etc/passwd /etc/hosts /etc/sudoers /etc/crontab

text

---

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: safe-shell-execution
description: Use this skill whenever an AI agent is about to execute shell commands, run bash/zsh scripts, invoke system operations, or process user-provided command strings. Provides layered safety checks — injection pattern detection, destructive operation warnings, and sensitive file protection — derived from production security engineering in Claude Code. Trigger even for "simple" commands: the most dangerous injections often hide in seemingly innocent inputs. If a user asks you to run any command, execute a script, or use a shell tool, this skill applies.
---

> **Origin**: This skill was extracted from Claude Code's internal implementation and rules. Claude Code openly exposes its safety mechanisms (hooks, system prompts, skill definitions) in the `~/.claude/` directory. The core safety patterns for shell execution — injection detection, destructive command classification, and sensitive path protection — were identified from Claude Code's production behavior and rewritten into a portable skill for OpenClaw agents.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to use the skill whenever an agent is about to execute shell commands and even for "simple" commands, concluding that if a user asks to run any command or use a shell tool, the skill applies. This is a very broad trigger without negative examples or tighter scope constraints, which risks unintended invocation for many ordinary developer interactions involving commands.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

- `zmodload` — Load modules, can enable invisible file I/O, pseudo-terminal execution, TCP connections
- `zpty` — Execute commands on pseudo-terminals
- `ztcp` / `zsocket` — Create network connections, can be used for data exfiltration
- `sysopen` / `sysread` / `syswrite` / `sysseek` — Low-level file descriptor operations
- `emulate -c` — eval equivalent, can execute arbitrary code
- `zf_rm` / `zf_mv` / `zf_ln` / `zf_chmod` / `zf_chown` / `zf_mkdir` / `zf_rmdir` — Built-in file operations, can bypass binary whitelists

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

- `zpty` — Execute commands on pseudo-terminals
- `ztcp` / `zsocket` — Create network connections, can be used for data exfiltration
- `sysopen` / `sysread` / `syswrite` / `sysseek` — Low-level file descriptor operations
- `emulate -c` — eval equivalent, can execute arbitrary code
- `zf_rm` / `zf_mv` / `zf_ln` / `zf_chmod` / `zf_chown` / `zf_mkdir` / `zf_rmdir` — Built-in file operations, can bypass binary whitelists

---